Which versions of theme-color-picker are malicious?

The following npm versions of theme-color-picker are flagged malicious: 2.0.28, 2.0.30, 2.0.31. Treat any of these as compromised.

How do I remediate theme-color-picker if I installed it?

theme-color-picker carries a destructive/sabotage payload. Remove it immediately, restore any affected data from clean backups, and verify integrity of build outputs that may have been tampered with.

I already installed theme-color-picker — how do I know if it already compromised me?

If theme-color-picker was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is theme-color-picker part of a known attack campaign?

Yes — theme-color-picker is associated with the IN-MAL-2026-007385, IN-MAL-2026-007382, IN-MAL-2026-007381 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find theme-color-picker across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for theme-color-picker (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging theme-color-picker across your stack and pipelines.

Malicious package

theme-color-pickernpm

Malicious code in theme-color-picker (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-6357

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall theme-color-picker

What this malware does

Although the package presents itself as a 'theme color picker', package.json identifies the publisher as analysis-chart.io with repository analysis-chart/analysis-chart, and the shipped lib/picker.js is a Windows dropper unrelated to any color-picker functionality. lib/picker.js (line 11) downloads https://github.com/Analysis-Chart/analysis-chart/releases/download/v1/payload.bin.enc, XOR-decrypts the response with key 0x42, base64-decodes it, validates an MZ/PE header, writes the resulting DLL under %APPDATA%/Microsoft/Windows with a randomized name, and executes it via rundll32. It then registers a Scheduled Task named 'WindowsUpdateService' to re-launch the DLL at logon with HIGHEST privileges, deletes the package files from node_modules, and rewrites the consumer's root package.json to remove the 'analysis-chart' dependency entry to hide its tracks. package.json declares scripts.install: 'node lib/chart-loader.js', wiring auto-execution at npm install; the dropper logic is colocated in lib/ alongside that hook. The user-facing index.js color-picker is cover. Installer impact: Windows machines that run npm install of this package fetch and execute attacker-controlled native code with persistence; the malicious tree then self-removes from node_modules and the root manifest, complicating detection.

Malicious versions

3 flagged

2.0.282.0.302.0.31

Indicators of compromise (SHA-256)

b6c09be3eb1dc3366475cc81c7891df6efb6b246b644e9700c50fee0ba035f2c

f6d983ef80a9e7b5526921781d11369f3ef01e5b86a9250ce284f93006161c5a

f7a4ba7e8664b9e1d99c4018963a4731d591653d7f2a9b879ba090e7a7f6e7bd

Detection & response playbook

Destructive / sabotage

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for theme-color-picker (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging theme-color-picker across your stack and pipelines.
If you installed it — respond
theme-color-picker carries a destructive/sabotage payload. Remove it immediately, restore any affected data from clean backups, and verify integrity of build outputs that may have been tampered with.
Did it already run?
If theme-color-picker was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks theme-color-picker before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. theme-color-picker on npm has been identified as a malicious package (versions 2.0.28, 2.0.30, 2.0.31 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007385IN-MAL-2026-007382IN-MAL-2026-007381

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks theme-color-picker-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring